Privacy policy

1.1 Scope of this privacy policy

This document sets out the privacy policy of Clinrol Pty Ltd ABN 29 640 485 105 (Clinrol). In this privacy policy, we refer to ourselves as ‘we’, ‘us’, or ‘our’.

Clinrol is a clinical trial patient recruitment and technology company. This privacy policy applies to all of our products and services, including:

• our websites at clinrol.com and any related websites, applications and social media pages (Website);
• Clinrol Recruit, our patient recruitment service, through which we identify, pre-screen and refer potential participants to clinical trials and research studies conducted by trial sites, site networks, sponsors and contract research organisations (Research Partners);
• Clinrol Connect, our software platform used by Research Partners to manage patient recruitment, screening, scheduling and enrolment; and
• any other products, services, platforms, applications or tools that we offer now or in the future,

(together, the Services).

We are committed to complying with the privacy and data protection laws that apply to us in each place we operate, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles (Privacy Act), the Privacy Act 2020 (NZ), the General Data Protection Regulation (EU) 2016/679 (the “GDPR”), the UK GDPR and the UK Data Protection Act 2018, applicable United States federal and state privacy laws (including the California Consumer Privacy Act, as amended (CCPA)), and the personal data protection laws of Singapore, Malaysia, the Philippines, Thailand, Indonesia, Vietnam and other countries in Southeast Asia in which we operate (together, Privacy Laws). Section 14 sets out additional information that applies to you depending on where you are located.

This privacy policy applies whenever we collect your personal information and/or personal data (your personal data). It applies to you whether you are a visitor to our Website, a potential or current clinical trial participant, a patient or carer, a user of Clinrol Connect, personnel of a Research Partner or other business customer, a supplier, a job applicant or an investor. This privacy policy applies to our use of any and all data collected by us or provided by you in relation to your use of the Services and the provision of our services to you.

1.2 Our role: controller and processor

When we operate the Website or provide Clinrol Recruit, we decide how and why your personal data is processed. In those cases we act as a data controller under the GDPR and UK GDPR, a ‘business’ under the CCPA, an ‘organisation’ under the Privacy Laws of Southeast Asia and an ‘APP entity’ under the Privacy Act, and this privacy policy applies in full.

When we provide Clinrol Connect or other Services to a Research Partner, the Research Partner decides the purposes for which personal data is processed and we process that personal data on its behalf and on its instructions, as a data processor or ‘service provider’. In those cases, the Research Partner’s own privacy policy and the study’s informed consent documents govern the processing, and you should direct any privacy requests to the Research Partner in the first instance. We will assist Research Partners to respond to your requests where required by law or by our agreement with them.

We take our privacy obligations seriously. Please read this privacy policy carefully as it contains important information on who we are and how and why we collect, store, use and share your personal data in connection with your use of the Services. It also explains your rights in relation to your personal data and how to contact us or a relevant regulator in the event you have a complaint.

The personal data we collect may include the following:

• name;
• mailing or street address;
• email address;
• social media information;
• telephone number and other contact details;
• age;
• date and country of birth;
• gender;
• credit card or other payment information (which is processed by our third-party payment processors and is not stored by us in full);
• sensitive information (such as health information) as set out below;
• information about your business or personal circumstances, including your occupation, employer and role where you are personnel of a Research Partner or other business customer;
• information in connection with any screening or pre-screening questionnaires, surveys, forms or client questionnaires you complete, including your interest in and availability for clinical trials, your general location and your travel preferences;
• records of your communications with us, including call recordings and transcripts where we have notified you that a call is being recorded;
• account information when you use Clinrol Connect, including your login details, role, activity logs and content you or your organisation upload to the platform;
• information about your participation in clinical trials, such as whether you were contacted, screened, enrolled in or completed a study, which we may receive from Research Partners;
• when we use analytical and advertising cookies and similar technologies, your device identity and type, IP address, geo-location information, page view statistics, advertising data and standard web log information;
• information about third parties, such as a carer, family member or emergency contact you nominate; and
• any other information provided by you to us via the Services, in the course of us providing services to you, or otherwise required by us or provided by you.

3.1 general

We will collect your personal information in a lawful and fair way. We will only collect your personal information where you have consented to it, or otherwise in accordance with the law. Where it is lawful and practicable, we will give you the option of dealing with us anonymously or using a pseudonym, for example when you make a general enquiry through our Website.

3.2 How we collect information from you

We may collect personal data where you:

• contact us through our Website, by email or by telephone;
• complete screening and pre-screening questionnaires to determine your potential eligibility for, and interest in, clinical trials;
• communicate with us via email, telephone, SMS, social applications (such as Instagram, LinkedIn or Facebook) or otherwise;
• register your interest in a clinical trial, create a profile with us, or ask us to notify you about trials that may be suitable for you;
• are referred by us to a Research Partner, and the Research Partner reports back to us on the outcome of your referral;
• create or use an account on Clinrol Connect, or are entered into Clinrol Connect by a Research Partner;
• engage us to perform services to you;
• when you or your organisation offer to provide, or provides, services to us;
• interact with our Website, social applications, services, content and advertising, including when you respond to our clinical trial recruitment advertisements;
• invest in our business or enquire as to a potential purchase in our business; and
• apply for a job with us.

3.3 How we collect information from third parties

Where possible, we collect your personal information directly from you. However, there may be occasions when we collect personal information (including sensitive information) about you from someone else, including:

• Research Partners, including trial sites, sponsors and contract research organisations, for example when they confirm whether you were contacted, screened or enrolled in a study, or when they upload information about you to Clinrol Connect;
• healthcare professionals, patient organisations or advocacy groups that refer you to us with your consent;
• advertising and social media platforms (such as Meta and Google) when you respond to our advertisements;
• publicly available sources and business databases, where you are personnel of a Research Partner or a prospective business customer;
• a carer, family member or other person who provides information on your behalf; and
• our service providers, such as analytics and identity verification providers.

3.4 How you provide information for someone else

If you are providing personal and/or sensitive information on behalf of someone else, you must have the consent of that person to provide their personal and/or sensitive information to us to be collected, used, and disclosed in accordance with this privacy policy.

If you are providing personal and/or sensitive information on behalf of someone under the age of 18, or the age of majority in the place where they live (Minor), you must be that Minor’s parent or legal guardian and you must provide consent for the Minor’s personal and/or sensitive information to be collected, used and disclosed in accordance with this privacy policy.

3.5 How we collect information from cookies

We may also collect personal information from you when you use or access our Website or our social media pages. This may be done through use of web analytics tools, ‘cookies’, pixels, tags or other similar tracking technologies that allow us to track and analyse your website usage. Cookies are small files that store information on your computer, mobile phone or other device and enable and allow the creator of the cookie to identify when you visit different websites. Where required by law, we will ask for your consent through our cookie banner before placing non-essential cookies on your device, and you can change your preferences at any time. If you do not wish information to be stored as a cookie, you can also disable cookies in your web browser, although some parts of the Website may then not function properly.

We use analytics and advertising tools such as Google Analytics, Google Ads and the Meta Pixel to measure the use of our Website and the performance of our clinical trial recruitment advertising. These tools may collect information about your device and browsing activity, including on third-party websites and apps. We do not share health information that you provide to us in a screening questionnaire with advertising platforms for the purpose of targeting advertising to you. To find out more about how Google uses data, see https://policies.google.com/technologies/partner-sites.

4.1 primary purpose

We collect and use personal information for the following primary purposes:

• to provide the Services to you, including to assess your potential eligibility for clinical trials, to match you with suitable trials and, with your consent, to refer you to Research Partners;
• to operate Clinrol Connect for Research Partners and to support their recruitment, screening, scheduling and enrolment activities;
• for record keeping and administrative purposes;
• to comply with our legal obligations, resolve disputes or enforce our agreements with third parties;
• where we have your consent, including to send you marketing and promotional messages and other information that may be of interest to you. In this regard, we may use email, SMS, social media or mail to send you direct marketing communications. You can opt-out of receiving marketing materials from us by using the opt-out facility provided (e.g. an unsubscribe link);
• for our legitimate interests including:

• to develop and carry out marketing activities and to conduct market research and analysis and develop statistics;
• to improve and optimise our service offering and customer experience;
• to send you administrative messages, reminders, notices, updates and other information requested by you;
• to consider an application for employment from you;
• to secure our systems, prevent fraud and misuse, and verify accounts; and
• to prepare de-identified or aggregated reports and insights about recruitment performance for Research Partners and for our own business purposes.

4.2 Lawful bases under the GDPR and UK GDPR

Where the GDPR or UK GDPR applies to our processing, we rely on the following lawful bases:

• your consent, including your explicit consent for the processing of health data and other special category data (Article 9(2)(a));
• the performance of a contract with you, or taking steps at your request before entering into a contract, for example where you or your organisation subscribes to Clinrol Connect;
• compliance with our legal obligations; and
• our legitimate interests as described above, where those interests are not overridden by your interests, rights and freedoms.

4.3 secondary purpose

We may also use your personal information for:

• secondary purposes closely related to the primary purpose, in circumstances where you would reasonably expect such use;
• any other purpose for which we receive consent from you; or
• any other purpose which is permitted or required under applicable privacy laws.

4.4 Automated decision-making and profiling

Our screening and pre-screening questionnaires use eligibility criteria supplied by Research Partners to indicate whether you may be eligible for a particular trial. This matching process may be automated. An indication of eligibility is not a medical assessment and does not mean that you will be enrolled in a trial. Final eligibility decisions are always made by qualified personnel at the trial site. If you are in a jurisdiction that gives you the right not to be subject to a decision based solely on automated processing which produces legal or similarly significant effects, you may request human review of any such decision by contacting us using the details below.

We may share your personal data in certain circumstances, as follows:

• Research Partners: with your consent, we share your contact details, your screening responses and relevant health information with the trial site, sponsor or contract research organisation conducting the study you have expressed interest in, so that they can contact you and assess your eligibility. Once shared, the Research Partner will handle your personal data in accordance with its own privacy policy and the study’s informed consent documents;
• health service providers, where you ask us to refer you to a healthcare professional or service;
• where there is a change of control in our business or a sale or transfer of business assets, we reserve the right to transfer to the extent permissible at law our user databases, together with any personal data and non-personal data contained in those databases. This information may be disclosed to a potential purchaser under an agreement to maintain confidentiality. We would seek to only disclose information in good faith and where required by any of the above circumstances;
• our related bodies corporate, and our directors, employees and contractors, who need the information to perform their roles;
• regulators, human research ethics committees, institutional review boards and law enforcement agencies where required or authorised by law;
• disclosures required by law or regulation; and
• service providers and other third parties who help us to operate the Services, including cloud hosting, data storage, customer relationship management, communications (email, SMS and telephony), analytics, advertising, payment processing, identity verification and customer support providers, and professional advisers such as lawyers, accountants, auditors, insurers and overseas counsel. We require these providers to protect your personal data and to use it only for the purposes for which we disclose it to them.

We do not sell your personal data, and we do not disclose your health information to third parties for their own marketing purposes.

6.1 Collection of sensitive information

We collect sensitive information (including health information and, where the GDPR applies, ‘special category data’) only with your express consent, or where otherwise permitted or required by Privacy Laws. We will ask for your consent when you complete a screening or pre-screening questionnaire or otherwise provide health information to us in the course of using the Services.

The type of sensitive information we may collect includes:

• health information such as medical history, current and previous diagnoses, symptoms, medication history, treatments, family medical history, lifestyle information relevant to a clinical trial and other health records;
• racial or ethnic origin, and genetic or biometric information, where relevant to the eligibility criteria of a clinical trial; and
• any other sensitive information provided by you or a third party to us via our website or platforms, or otherwise provided by you or a third party to us.

6.2 How we use your sensitive information

Your sensitive information will only be used for the purpose of:

• responding to your queries;
• providing you with the Services, including assessing your potential eligibility for clinical trials and matching you with suitable trials;
• complying with our legal, regulatory and ethical obligations, resolving disputes or enforcing our agreements with you;
• sending you messages, reminders, notices, updates, security alerts, and other information requested by you; or
• any other purpose which is permitted or required under applicable privacy laws.

6.3 How we disclose your sensitive information

With your consent, we disclose your sensitive information to the Research Partners conducting the clinical trials you have expressed interest in, and to health service providers where you ask us to refer you. We may also disclose sensitive information to service providers who host or process it on our behalf under strict confidentiality and data processing obligations, and for data analytics in de-identified form as described in section 8. Except with your consent or as required or authorised by law, we do not disclose your sensitive information for any other purpose.

6.4 How you can withdraw consent

If you wish to withdraw your consent to our collection, use or disclosure of your sensitive information, please contact us using the contact details set out below. We will deal with all such requests within a reasonable timeframe. Withdrawing your consent will not affect the lawfulness of any processing carried out before you withdrew it, but it may mean that we can no longer match you with, or refer you to, clinical trials.

We may at times send you marketing communications, which we will do in accordance with the laws that apply to you, including the Spam Act 2003 (Cth) (Spam Act), the Unsolicited Electronic Messages Act 2007 (NZ), the GDPR and the UK Privacy and Electronic Communications Regulations, the US CAN-SPAM Act and Telephone Consumer Protection Act, and the direct marketing and ‘do not call’ provisions of the Privacy Laws in Southeast Asia.

If we do, we may use email, SMS, social media, phone or mail to send you direct marketing communications.

Where consent is needed, we will ask you for your consent before sending you marketing communications, except where you:

• have explicitly opted-in to receiving email marketing from us in the past; or
• are an existing customer, were given the option to opt-out of marketing when you provided your details to us or signed up for one of our platforms, did not do so, and the marketing relates to products or services similar to those you have obtained from us.

You can, at any time, opt out of receiving marketing materials from us by using the opt-out facility provided (e.g., an unsubscribe link on emails we send you) or by contacting us via the details provided at the end of this privacy policy. We will implement such a request as soon as possible, however, cannot guarantee that such a response will be immediate.

We will only notify you about specific clinical trials or health conditions where you have asked us to do so, for example by registering your interest in being notified about trials that may be suitable for you.

The information we collect may have analytical, educational, scientific or commercial value to us and to Research Partners. We may de-identify or aggregate personal data so that it can no longer reasonably be used to identify you, and we may use and share that de-identified or aggregated information for any purpose, including research, benchmarking and reporting on recruitment performance. We will not attempt to re-identify de-identified information, and we require recipients of it not to do so. Where the GDPR applies, information that has only been pseudonymised remains personal data and is handled in accordance with this privacy policy.

We take reasonable steps to ensure your personal data is secure and protected from misuse, interference, loss and unauthorised access, modification or disclosure. Our measures include encryption of data in transit and at rest, access controls and multi-factor authentication, logging and monitoring, staff training and confidentiality obligations, and contractual security obligations on our service providers. However, no method of transmission or storage is completely secure and we cannot guarantee the security of your personal data. If a data breach occurs that is likely to result in serious harm to you or a risk to your rights and freedoms, we will notify you and the relevant regulator where required by law, including under the Notifiable Data Breaches scheme in Australia and Articles 33 and 34 of the GDPR.

Our website may contain links to other websites. Those links are provided for convenience and may not remain current or be maintained. We are not responsible for the privacy practices of those linked websites and we suggest you review the privacy policies of those websites before using them.

Depending on where you are located and which Privacy Laws apply to you, you may have some or all of the following rights with respect to our use of your personal data:

• Access: You have the right to obtain access to your information (if we’re processing it) and certain other information (similar to that provided in this privacy notice). This is so that you’re aware and can check that we’re using your information in accordance with data protection law.
• Be informed: You have the right to be provided with clear, transparent and easily understandable information about how we use your information and your rights. This is why we’re providing you with the information in this privacy policy.
• Rectification: We aim to keep your personal data accurate, current, and complete. We encourage you to contact us using the contact details below to let us know if any of your personal data is not accurate or changes, so that we can keep your personal data up-to-date.
• Objecting: You also have the right to object to processing of your personal data in certain circumstances, including processing for direct marketing.
• Restricting: You have the right to ‘block’ or suppress further use of your information. When processing is restricted, we can still store your information, but may not use it further.
• Erasure: You have the right to ask us to erase your personal data when the personal data is no longer necessary for the purposes for which it was collected, or when, among other things, your personal data have been unlawfully processed.
• Portability: You have the right to request that some of your personal data is provided to you, or to another data controller, in a commonly used, machine-readable format.
• Complaints: If you believe that your data protection rights may have been breached, you have the right to lodge a complaint with the applicable supervisory authority or privacy regulator. Details are set out in section 15.
• Withdraw consent: If you have given your consent to anything we do with your personal data, you have the right to withdraw your consent at any time. This includes your right to withdraw consent to us using your personal data for marketing purposes, and to us sharing your health information with Research Partners.
• Automated decisions: You have the right not to be subject to a decision based solely on automated processing which produces legal or similarly significant effects on you, as described in section 4.4.
• Non-discrimination: We will not discriminate against you, deny you services or charge you a different price because you have exercised any of your privacy rights.

You may, at any time, exercise any of the above rights by contacting us using the details provided below. We may need to verify your identity before acting on a request. We will respond within the time required by the Privacy Laws that apply to you (generally within one month under the GDPR and within 30 days under the Privacy Act and the CCPA) and will tell you if we need more time. We do not charge a fee for handling requests unless the law permits it. If we refuse a request, we will tell you why. If we process your personal data on behalf of a Research Partner, we may refer your request to that Research Partner.

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Where we refer you to a clinical trial, records of the referral and of your consent may need to be retained for the period required by the sponsor, ethics committee or regulator, which under clinical trial regulations and ICH Good Clinical Practice guidelines can be 15 years or more after the trial ends. Personal data that we process on behalf of Research Partners through Clinrol Connect is retained in accordance with our agreement with that Research Partner. We will securely destroy or de-identify your personal data in accordance with applicable laws and regulations when it is no longer required.

If you would like further information about our specific retention periods for your personal data, please contact us using our email address provided below.

We are based in Australia and we use service providers and work with Research Partners located in other countries. Depending on where you are, your personal data may be transferred to, stored in or accessed from countries other than the one in which you reside, including Australia, New Zealand, the United States, the United Kingdom, countries in the European Economic Area, Singapore and other countries in which we, our Research Partners or our service providers operate. Those countries may not provide the same level of data protection as the country in which you reside and may not be recognised by the European Commission or the UK Government as providing an adequate level of data protection.

When we transfer personal data internationally, we will put in place the safeguards required by the Privacy Laws that apply to you, which may include:

• transferring only to countries recognised as providing an adequate level of data protection;
• the European Commission’s standard contractual clauses, the UK International Data Transfer Agreement or Addendum, or the ASEAN Model Contractual Clauses;
• contractual obligations requiring the recipient to protect your personal data to a standard comparable to that required by the Privacy Laws that apply to you, as required by Australian Privacy Principle 8, the Privacy Act 2020 (NZ) and the transfer limitation obligations under the Privacy Laws of Singapore, Malaysia, the Philippines, Thailand, Indonesia and Vietnam; and
• your consent, where permitted.

For more information, please contact us at our email address provided below.

14.1 Australia and New Zealand

We are bound by the Australian Privacy Principles under the Privacy Act. If you are in New Zealand, we also comply with the Information Privacy Principles under the Privacy Act 2020 (NZ). You may request access to, and correction of, the personal information we hold about you under Australian Privacy Principles 12 and 13 or Information Privacy Principles 6 and 7, and we will respond within 30 days (or 20 working days in New Zealand). If we refuse your request, we will give you written reasons and information about how to complain. We will notify you and the Office of the Australian Information Commissioner or the Office of the Privacy Commissioner (NZ) of eligible or notifiable privacy breaches as required by law.

14.2 European Economic Area and United Kingdom

If you are in the EEA or the UK, the data controller of your personal data is Clinrol Pty Ltd, unless we are processing your personal data on behalf of a Research Partner as described in section 1. Questions about our processing can be directed to our Privacy Officer at privacy@clinrol.com. The lawful bases on which we rely are set out in section 4.2, and your rights are set out in section 11. You may lodge a complaint with the supervisory authority in the EU member state in which you live or work, or with the UK Information Commissioner’s Office.

14.3 United States

If you are a resident of California or another US state with a comprehensive privacy law (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, New Jersey, New Hampshire, Iowa, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island), you may have the right to know what personal information we collect and how we use and disclose it, to access, correct and delete your personal information, to obtain a portable copy of it, to opt out of the sale or sharing of your personal information and of targeted advertising and profiling, to limit our use of your sensitive personal information, and not to be discriminated against for exercising your rights. You may exercise these rights, or authorise an agent to do so on your behalf, by contacting us using the details below. We will verify your identity before responding.

In the preceding 12 months we have collected the categories of personal information described in section 2, from the sources described in section 3, for the purposes described in section 4, and have disclosed them to the categories of recipients described in section 5. These include identifiers, contact information, characteristics of protected classifications (such as age, gender and race or ethnicity), commercial information, internet or network activity, geolocation data, professional or employment information, and sensitive personal information (including health information). We do not sell personal information and have not done so in the preceding 12 months. We may ‘share’ identifiers and internet activity information with advertising partners for cross-context behavioural advertising. You can opt out of this by using the ‘Do Not Sell or Share My Personal Information’ link on our Website, by enabling a Global Privacy Control signal in your browser, or by contacting us. We do not knowingly sell or share the personal information of consumers under 16 years of age.

Health information that you provide directly to us is generally not ‘protected health information’ under the Health Insurance Portability and Accountability Act (HIPAA). Where we receive protected health information from, or process it on behalf of, a Research Partner that is a HIPAA covered entity, we do so as a business associate in accordance with our business associate agreement with that Research Partner. If you are a resident of Washington, Nevada or another state with a consumer health data law, we collect, use and share your consumer health data only as described in section 6 and with your consent, and you may withdraw your consent and request deletion of your consumer health data by contacting us.

The Services are not directed to children under 13 years of age, and we do not knowingly collect personal information from children under 13 without verifiable parental consent.

14.4 Southeast Asia

If you are in Singapore, Malaysia, the Philippines, Thailand, Indonesia, Vietnam or another country in Southeast Asia, we comply with the Privacy Laws that apply to you, including the Personal Data Protection Act 2012 (Singapore), the Personal Data Protection Act 2010 (Malaysia), the Data Privacy Act of 2012 (Philippines), the Personal Data Protection Act B.E. 2562 (2019) (Thailand), Law No. 27 of 2022 on Personal Data Protection (Indonesia) and the Law on Personal Data Protection and Decree 13/2023/ND-CP (Vietnam). In these countries we generally rely on your consent to collect, use and disclose your personal data for the purposes set out in this privacy policy, and we will notify you of those purposes at or before the time of collection. You may withdraw your consent at any time by contacting us, although this may mean that we are no longer able to provide the Services to you. Our Privacy Officer performs the role of data protection officer where one is required and can be contacted using the details below. We will only transfer your personal data out of your country where the recipient is bound by legally enforceable obligations to protect it to a standard comparable to that required by your local Privacy Laws, or where you have consented to the transfer. You may lodge a complaint with your local data protection authority, including the Personal Data Protection Commission (Singapore), the Department of Personal Data Protection (Malaysia), the National Privacy Commission (Philippines), the Personal Data Protection Committee (Thailand), the Personal Data Protection Agency (Indonesia) or the Department of Cybersecurity and High-Tech Crime Prevention of the Ministry of Public Security (Vietnam).

If you wish to complain about how we handle your personal information, please contact us using the details set out below, including your name and contact details. We will acknowledge your complaint promptly, investigate it and respond to you within 30 days, or tell you if we need more time.

For data which is subject to the GDPR, you have the right to lodge a complaint with the local regulator in your jurisdiction in Europe if you do not feel we have adequately upheld your rights under GDPR.

If you are located in Australia, you have the right to contact the Office of the Australian Information Commissioner (OAIC) at https://www.oaic.gov.au/contact-us if you believe that your data has not been handled in accordance with the law.

If you are located in New Zealand, you have the right to contact the Office of the Privacy Commissioner at https://www.privacy.org.nz if you believe that your data has not been handled in accordance with the law.

If you are located in the United Kingdom, you have the right to contact the Information Commissioner's Office (ICO) at www.ico.org.uk if you believe your data has not been handled in accordance with the law.

If you are located in the United States, you may also contact the Federal Trade Commission or the Attorney General of your state. If you are located in Southeast Asia, the relevant regulators are listed in section 14.4.

For further information about our privacy policy or practices, or to access or correct your personal data, or make a complaint, please contact us using the details set out below:

Email: privacy@clinrol.com (Attention: Privacy Officer)

We may change this privacy policy from time to time by posting an updated copy on our website and we encourage you to check our website regularly to ensure that you are aware of our most current privacy policy. Where we make any significant changes, we will endeavour to notify you by email.